fix: add contents:write permission to release job

[cx-luis-ventuzelos]

Summary

• git push origin "${tag}" was failing with 403 — github-actions[bot] denied write access
• Added contents: write permission scoped to the release job only (least-privilege)

Root cause

The workflow had no permissions block, so the token defaulted to read-only for contents.

Test plan

• Trigger a release workflow run and confirm the Tag step passes

[stepsecurity-app]

Security Policy Alert: Actions Policy Violation

This workflow run has been blocked by StepSecurity's actions policy.

Disallowed Actions:

• timonvs/pr-labeler-action@f9c084306ce8b3f488a8f3ee1ccedc6da131d1af

To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed.

For more information, see StepSecurity's Actions Policy documentation.

[stepsecurity-app]

Security Policy Alert: Actions Policy Violation

This workflow run has been blocked by StepSecurity's actions policy.

Disallowed Actions:

• darenm/setup-vstest@3a16d909a1f3bbc65b52f8270d475d905e7d3e44

To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed.

For more information, see StepSecurity's Actions Policy documentation.